# DF-2385 - package helpers index Elements[idx] unchecked

## Rig (ACHARNESS, op=pkg_oob_canary)
Package with Count=2 whose backing store holds a third, hostile element
(Type=INTEGER, Value=0xCAFEF00DBAADC0DE) past Count - what an adjacent
heap chunk looks like when its first bytes happen to be 01 00 00 00.
`acpi_PkgInt(&pkg, 2, &dst)` must NEVER be able to return it.

## Baseline (run.log)
```
acpi_PkgInt(idx=0 < Count) -> error=0 value=0x1111111111111111  (control)
acpi_PkgInt(idx=2 == Count) -> error=0 value=0xcafef00dbaadc0de  <-- OOB READ
VERDICT: BUG REPRODUCED
```

## Fixed kernel (fix.diff: idx bounds check in all four helpers)
```
acpi_PkgInt(idx=2 == Count) -> error=22 value=0xdeadbeefdeadbeef  (EINVAL)
```

A page-edge variant (element on an unmapped page) was prepared but the
DFly kernel_map is densely mapped - no unmapped neighbor could be found
(noted in run.log).